Microsoft breaks Patch Tuesday record with fixes for over 200 security flaws

June 2026 Patch Tuesday release fixes nearly 200 Windows vulnerabilities, Microsoft’s biggest release yet
It includes Chaotic Eclipse’s GreenPlasma (CVE-2026-45586) and YellowKey (CVE-2026-45585), disclosed without coordination
AI-powered bug detection fuels record patch volumes, expected to continue to grow

The June 2026 Patch Tuesday cumulative update for Microsoft’s Windows operating system has been released – and is by far the largest the company has ever released.

The update addresses nearly 200 security vulnerabilities across Windows systems, as well as supported software, dozens of which are labeled “critical,” meaning they could cause serious harm to users.

Among the bugs are two vulnerabilities disclosed by Chaotic Eclipse, a mysterious researcher who recently clashed with Microsoft over how vulnerabilities were reported and researchers credited/compensated.

Using AI to detect security issues

By fixing nearly 200 bugs, Microsoft essentially broke its own record – in part due to the use of artificial intelligence (AI).

The first major problem is GreenPlasma, an elevation-of-privilege vulnerability in the Windows Collaborative Translation Framework (CTF). This flaw, tracked as CVE-2026-45586 and given a severity rating of 7.8/10 (high), allows a local attacker to gain elevated privileges on Windows systems.

The other is YellowKey, a Windows BitLocker Security Feature Bypass vulnerability tracked as CVE-2026-45585 and given a severity score of 6.8/10 (medium). proof of concept (PoC) for this vulnerability has been published, NVD said, which is against coordinated vulnerability best practices.

As a result, Microsoft said it was considering legal action against Chaotic Eclipse if it had been found to be in violation of the law. In its follow-up advisory to Patch Tuesday, the company did not credit any researchers for those two flaws, but said only that it “recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.”

Via Cancer about security